5 ms·

so what? Private doesn't imply (common sense) that the original repository has power over any fork.

dboreham 4y ago
It does, otherwise github just wouldn't allow forking private repositories. If they did allow that, and retained no control over the forked copy, now you can ride a coach and horses through the access control to a private repo by simply forking it when you have access. My guess is that forking a private repository is a feature github intended to be used where employees or contractors of an enterprise want to fork their employer's repository as part of their development activities for that employer. Github sees those forks as transitively controlled under the organization's access policies.
- Dylan16807 4y ago
  > If they did allow that, and retained no control over the forked copy, now you can ride a coach and horses through the access control to a private repo by simply forking it when you have access. ...which you can still trivially do if you use git to make the copy. And then your github repo will be immune to this kind of deletion. So common sense says to me this should act similarly.
  - djur 4y ago
    > ...which you can still trivially do if you use git to make the copy. If you want to steal code from your former employer it's your business and your legal jeopardy. GitHub can't do anything about that. They can remove access to the copies they're storing for you, though. GitHub has a weird model where they encourage using the same account for personal and professional work, which causes this kind of ambiguity. From their perspective, there isn't a real difference between forking a private repo and making a private copy of a shared Google doc in your work account.
    - Dylan16807 4y ago
      It's not about wanting to steal anything. It's that making a copy is trivial, so there's no point in worrying about how you can "you can ride a coach and horses through the access control". Don't worry about the barn door when there is no side on the barn.
      - djur 4y ago
        My point is that GitHub does not personally want to have a hand on the reins, or whatever metaphor we're doing here. A private fork is a copy of the original code that GitHub is holding onto. A clone on your personal computer or server or printed out on paper tape is a copy that you are holding on to.
- kitkat_new 4y ago
  " If they did allow that, and retained no control over the forked copy, now you can ride a coach and horses through the access control to a private repo by simply forking it when you have access. " Actually that's not really true, since your access to the original repository could still be revoked, and you are left with what you got. Further, see sibling comment. "My guess is that forking a private repository is a feature github intended to be used where employees or contractors of an enterprise want to fork their employer's repository as part of their development activities for that employer." what you describe is "internal visibility" https://docs.github.com/en/repositories/creating-and-managing-repositories/about-repositories https://docs.github.com/en/repositories/creating-and-managin...
IncRnd 4y ago
That is the exact meaning, which does seem to be common sense. You can fork from a public, private or internal repo. Public is public and the fork won't get deleted when the repo removes you. Private deletes your fork, since it isn't your repo. Internal requires gated access.
- kitkat_new 4y ago
  for me the exact meaning for private is "available for a selected audience"
  - IncRnd 4y ago
    Exactly. That implies that when a person is removed from the selected audience, they lose access to the private code.
    - kitkat_new 4y ago
      to my private repository, but not their own private repository. like it happens when a public repo goes private: I don't loose access to my fork of the repo but access to the original repo
      - djur 4y ago
        GitHub doesn't allow you to make a public fork of a private repo, either. When you make a fork of a private repo, the resulting repo is constrained to have no broader access than the original.
        kitkat_new 4y ago
        "GitHub doesn't allow you to make a public fork of a private repo, either. " where did I claim something like that?
        djur 4y ago

It does, otherwise github just wouldn't allow forking private repositories. If they did allow that, and retained no control over the forked copy, now you can ride a coach and horses through the access control to a private repo by simply forking it when you have access. My guess is that forking a private repository is a feature github intended to be used where employees or contractors of an enterprise want to fork their employer's repository as part of their development activities for that employer. Github sees those forks as transitively controlled under the organization's access policies.

Dylan16807 4y ago
> If they did allow that, and retained no control over the forked copy, now you can ride a coach and horses through the access control to a private repo by simply forking it when you have access. ...which you can still trivially do if you use git to make the copy. And then your github repo will be immune to this kind of deletion. So common sense says to me this should act similarly.
- djur 4y ago
  > ...which you can still trivially do if you use git to make the copy. If you want to steal code from your former employer it's your business and your legal jeopardy. GitHub can't do anything about that. They can remove access to the copies they're storing for you, though. GitHub has a weird model where they encourage using the same account for personal and professional work, which causes this kind of ambiguity. From their perspective, there isn't a real difference between forking a private repo and making a private copy of a shared Google doc in your work account.
  - Dylan16807 4y ago
    It's not about wanting to steal anything. It's that making a copy is trivial, so there's no point in worrying about how you can "you can ride a coach and horses through the access control". Don't worry about the barn door when there is no side on the barn.
    - djur 4y ago
      My point is that GitHub does not personally want to have a hand on the reins, or whatever metaphor we're doing here. A private fork is a copy of the original code that GitHub is holding onto. A clone on your personal computer or server or printed out on paper tape is a copy that you are holding on to.
kitkat_new 4y ago
" If they did allow that, and retained no control over the forked copy, now you can ride a coach and horses through the access control to a private repo by simply forking it when you have access. " Actually that's not really true, since your access to the original repository could still be revoked, and you are left with what you got. Further, see sibling comment. "My guess is that forking a private repository is a feature github intended to be used where employees or contractors of an enterprise want to fork their employer's repository as part of their development activities for that employer." what you describe is "internal visibility" https://docs.github.com/en/repositories/creating-and-managing-repositories/about-repositories https://docs.github.com/en/repositories/creating-and-managin...

IncRnd 4y ago

That is the exact meaning, which does seem to be common sense. You can fork from a public, private or internal repo. Public is public and the fork won't get deleted when the repo removes you. Private deletes your fork, since it isn't your repo. Internal requires gated access.

kitkat_new 4y ago
for me the exact meaning for private is "available for a selected audience"
- IncRnd 4y ago
  Exactly. That implies that when a person is removed from the selected audience, they lose access to the private code.
  - kitkat_new 4y ago
    to my private repository, but not their own private repository. like it happens when a public repo goes private: I don't loose access to my fork of the repo but access to the original repo
    - djur 4y ago
      GitHub doesn't allow you to make a public fork of a private repo, either. When you make a fork of a private repo, the resulting repo is constrained to have no broader access than the original.
      - kitkat_new 4y ago
        "GitHub doesn't allow you to make a public fork of a private repo, either. " where did I claim something like that?
        djur 4y ago